build(release): attach sources, javadoc and signatures to the release build

[marevol]

Summary

The 2.4.11 release failed at the publish step. Querying the Central Portal for the deployment returned:

deploymentState: FAILED
pkg:maven/org.codelibs/yuicompressor@2.4.11
  - Sources must be provided but not found in entries
  - Javadocs must be provided but not found in entries
  - Missing signature for file: yuicompressor-2.4.11.pom
  - Missing signature for file: yuicompressor-2.4.11.jar

Only the jar and the POM were uploaded. Two independent gaps in the POM caused it.

Signing never ran. #17 moved maven-gpg-plugin into the release profile, but nothing activates that profile during a release: release:perform runs its forked deploy build without it, because the POM never configured <releaseProfiles>.

Sources and javadoc were never built. The POM has never declared maven-source-plugin, and maven-javadoc-plugin carries no jar execution. Both used to be supplied by the super POM's implicit release-profile, which activates on performRelease=true — and maven-release-plugin 3.x defaults useReleaseProfile to false, so that property is no longer passed.

Changes Made

• Pinned maven-release-plugin at 3.3.1 and configured <releaseProfiles>release</releaseProfiles>, so release:perform passes -Prelease to the deploy build it forks
• Added maven-source-plugin 3.4.0 (attach-sources / jar-no-fork) to the release profile
• Added the attach-javadocs execution to the release profile; the plugin configuration itself still comes from the declaration in <build>
• Recorded the fix in CHANGELOG.md

Testing

• mvn clean verify -Prelease -DskipTests -Dgpg.skip=true → BUILD SUCCESS, producing the jar, -sources.jar and -javadoc.jar
• help:effective-pom -Prelease puts source, javadoc and gpg in the active <build>
• help:effective-pom without the profile leaves all three inside the inactive profile, so mvn install still succeeds unsigned — the behaviour Sign artifacts only in the release profile #17 restored
• GPG signing itself was not exercised: it was skipped to avoid a passphrase prompt. Worth one mvn clean verify -Prelease on a machine with the key before cutting the release

Breaking Changes

None.

Additional Notes

• Nothing was published to Central for 2.4.11 (the deployment failed), and main has been rolled back to the pre-release state with the yuicompressor-2.4.11 tag removed, so the version can be reused as-is once this lands
• docs/BUILDING.md already documents mvn clean package -P release as producing "sources, javadoc, and signed JARs"; that statement is only now actually true
• org.codelibs.maven:yuicompressor-maven-plugin has the sources half of the same problem and is fixed separately